Palo Alto Networks, Inc. (NASDAQ:PANW) Citi 2024 Global TMT Results Conference September 4, 2024 9:10 AM ET

Company Participants

Nikesh Arora - Chairman & Chief Executive Officer

Conference Call Participants

Fatima Boolani - Citi

Fatima Boolani

Good morning, everybody. I'd like to welcome you all to day one of Citi's Global TMT conference. I'm Fatima Boolani. I jointly Head of the Software Research team here, and I am absolutely delighted to be able to host, the CEO of Palo Alto Networks, Nikesh Arora. Thank you so much for being here.

Nikesh Arora

Thank you for having me.

Fatima Boolani

Well, I'm very excited to dig right into the discussion here. I want to start off with a very stratospheric-level question for you. 6.5 years ago, you joined Palo Alto, and you came into the industry proper with a fresh set of eyes and a clean sheet of paper. What are the biggest attitudinal shifts and changes you've witnessed in the market from a behavior procurement CIO pain point standpoint? And, the flip side of that, what has remained stubbornly unchanged?

Nikesh Arora

Good morning, Fatima. Lovely to see you as well.

Fatima Boolani

It's getting heavy.

Nikesh Arora

I understand that. Like, you chose the best ballroom in New York with the best lighting. So, we can get started. Like, in the last 5 years or 6 years, if you've looked around, because of the scale and the, let's say, impact of cyber-attacks. Cyber has gone from being something you did to something that boards and CEOs had to pay attention to. If you look at the last 3 months, you've seen a bunch of health care attacks. You've seen a bunch of attacks across industry, and these end up being substantive.

We have to report them to the SEC. So, it's and if you do we all do enterprise risk management on our boards, and suddenly cyber has made it to the top right category in terms of something that is important. So, there's more focus on it. It's across the board. Two, I think people have come to the conclusion that the old approaches of having 30 or 40 vendors in infrastructure and hoping you're safe isn't working because all these breaches are happening despite deploying that strategy. So, there's a lot of people saying something has to change.

And what's fascinating is the moment there's a breach, the remediation is to rip out all the gunk and replace it with solid cybersecurity vendors and platforms. So, the question is, why doesn't that happen before? Why do we have to wait for some sort of forcing function to happen? And you're seeing more and more of that as we go through technology cycles. The amount of time it used to take to fix the security problem used to be four to seven days. Now people are demanding hours. So, there's an attitudinal shift in the way CIOs, CISOs see this, where they think they need to get ahead of this problem, they to solve it faster.

And it's kind of interesting. You see one breach in healthcare, every other healthcare, CIO, CISO on the phone and talk and saying, how did you fix it? What do I need to do to get ahead of this? So, I think you're seeing more growing recognition that's kind of happening. I think in terms of what is stubbornly still saying the same is there are still some, there's a faction of believers who thinks the right answer, still keep going the way you used to do it and solve it one-point solution to a time, which is what we fondly call the best of breed strategy. And that's still prevalent in some cases and people still doing that. But I think it's a matter of like it's took the sales forces, the workday, the service of the world, 10 years, 15 years to replace the stitching of multiple tools and moving into platforms. And I think you're going to see a similar cycle in the cybersecurity space.

Question-and-Answer Session

Q - Fatima Boolani

Now I'm going to ask you the obligatory macro question, and I'm going to ask you this because you have a really interesting vantage point in terms of the types of pernicious problems and very real problems that you're solving for a lot of organizations that across broad swaths of the economy, right? So, you have CIOs, CTOs, CISOs coming through your offices, quarterly business reviews with your customers. So again, just from your vantage point the macroeconomic conditions have both been favorable to you from the consolidation argument standpoint, but also, it's tough. Budgets are tough to come by. We've all become armchair macro economists in the course of the last 12 months to 18 months, right? So, from your standpoint how is macro weighing or maybe even helping some of your customer dialogues in terms of budgetary allocation and budgetary growth?

Nikesh Arora

This might be slightly orthogonal from what you're hearing from other people. I haven't met a CIO or CISO who says, I'd love to do this, but I don't have the money. Because generally CFOs telling you that you can't fix something in cybersecurity. Nobody wants to take that responsibility to say, we're going to do this next year or until the next year just keep doing what you're doing and if there's a breach or a bad thing happens, don't worry about it. I got your back. So, the conversation never is that I don't have the budget. The conversation usually is, I have a budget, I can only buy so much because that's all my appetite is, or that's all I have resources to go execute. So, I can't do the whole thing at the same time. I have phased ideas about I want to do this this year and this next year.

That's fine.

I think what's different is, this is something we've talked about you and I is in the last 12 months to 18 months, while you've been doing your armchair macro thing, you were just talking about the CFOs are paying more attention. CFOs are saying, give me value for money. What are you spending this on? Why am we spending this? Why am I getting the right deal or not? So, I joke about, it's called the revenge of the CFOs, the interest rates brought them back. I was like our CFO depot who, weren't talking to him. And I was like, shit, it's cost me 6%. Why would I do this? So, I think you are seeing more financial discipline creep in from a budgetary perspective and some people are misinterpreting that to be macroeconomic issues with technology spending. I haven't seen macroeconomic issues around technology spending across the board. And nobody's saying I'm going to slow down my cloud transformation or am I not going to deploy AI because I don't have the budget. Because everybody believes it's existential.

Fatima Boolani

I want to go back to an earlier comment you made around, hey. There's this, you know, paradigm shift on a recognition from, the technical fee suite. Recognizing that a best-of-breed strategy obviously has limitations. Right? So, I also want to say you single-handedly added the term platformization to the investor vernacular. Right?

Nikesh Arora

So, I remember what you said yesterday.

Fatima Boolani

So, on that point there have been elements of platformization that you've been working on for a number of years just kind of given how expansive your portfolio is. But, like, circa 7 months ago, there was definitely more of a concerted shift and effort towards this notion of platformization. Right? So, from a standpoint of what you saw in the market and economy, what was it in the evolution of the customer behavior that prompted you to say, let's make a more deliberate move and have a more institutionalized set of approaches on this notion of platformization? And I think for the uninitiated, you can tell us what platformization is.

Nikesh Arora

Sure. Well, in short, platformization is sort of deploying four different products and trying to get one to talk to the other and then talk to the other one to talk to the other one.

You can have one platform that the products talk to each other so you can sort of input here and output there the other end of the 4th product as opposed to I'm trying to find the right, portfolio management analogy, but I can't come up with it. Right? So, if you had four different screens for Bloomberg, which are four different products, you'd understand the difference. Right? So, the question on what drove the impetus for platformization, a boss that I used to have with Google, Eric, was asked for a podcast. What would he have changed historically if you go back into something different? He says that I'd execute on my good ideas faster.

So, I wish we had done platformization faster. And maybe it is the right time for us to do it because I think our four products that connect into one platform are more ready to talk are more ready today than they were 1 year ago. But I think the other part of the realization was that this is something we have and most others don't. Right? I can give you a soft management platform with XIM and XDR and ITDR, and these are all three- or four-letter acronyms we create in our industry to protect our jobs, so please don't get confused.

But it's a platform that basically helps you manage your security operation center. And most security operation center have anywhere from five to 15 different tools, and we brought six or seven of the big ones together. And we're going to keep adding to it, and that's so you don't have to go buy 15 and stitch them and run from screen to screen. You can do it in one place. And connecting them together is not just about making the user interface work. It's also connecting the data in the back so you don't have to deal with managing data. And to give you a sense, we ingest 76 terabytes a day of data just in RSOC. So, there's no way possible that you can have 17 tools analyze 76 terabytes of data.

You have to have one thing that does it. This all goes to Google Cloud, goes to BigQuery, could go to Snowflake. So that's the kind of scale I'm talking about with one sock. Right? And we've sold about a 130 of them. We've deployed 50. We're already past 7.6 petabytes a day. This is not a this is not a human problem anymore. So, I think what drove us to go faster on it is the realization that something we have, others don't. And kind of right place, right time, CFOs are looking for a consolidated spend where they get more value for money, so that allows us to drive that even faster.

Fatima Boolani

On paper there's so much of a compelling value from exactly what you said, right? Immediate ROI, better outcomes, a lower administrative and operational overhead for an industry that is notorious for having a deficit.

Nikesh Arora

Sales call with me. That's been good.

Fatima Boolani

I'm available after end of the day.

Nikesh Arora

Alright, fantastic. Wonderful.

Fatima Boolani

So, when you think about, the opportunities for your go-to-market organization to come up with these wealth of data points that are very compelling for your customers. What has changed culturally from a go-to-market perspective, from your standpoint, to help you drive towards, more and more customers in your install base that are platformized, right? I think you've talked about, hey, there is a cohort of 5,000 customers that are most eligible to see the most amount of success from platformization, but you have 65,000 customers, right? So, what is the eligibility criteria that, hey, these are the 5,000 and how are, how should we think about that long tail of the remaining 60 plus.

Nikesh Arora

Yeah, I think it's important to understand we have 62,000 customers of all shapes and sizes. We didn't say these, the 5,000 that qualify, we said our top 5,000 customers and we have three platforms, so eligible, so that'd be 15,000 platformization deals, right? If even we got to 25% penetration in that $15,000 opportunities, we'd hit $15 billion in ARR. That's the math we did. And you could be customer 6,000 and make your way up to 5,000. You want to spend more money with us. So, it's not like we chose 5,000. Everybody else is ignored. We're just saying you do the math. We just need 5,000 great customers who will do at least one platformization or 0.6 platformization with us to get us to our number. And yeah, so that's the map.

Fatima Boolani

So, related to that, I mean we kind of meandered through this topic around, platformization is allowing you to have very real conversations on dollars and cents with CFOs and even from a architectural and technology consolidation standpoint. So clearly good traction here. You know, I think we're getting a good sense of what the killer advantages are for moving down the platformization curve or moving up rather. But these are inherently large deal tickets, right? So, in.

Nikesh Arora

That's a good thing.

Fatima Boolani

It is a good thing. So, I want to get your sense from, hey, you're doing more than $2 million on average in terms of ARR per platformized customer, right? That's big. But even if we take a step back that's not as big in the grand scheme of things when maybe we compare your business to a ServiceNow, think their ACVs with their customers are mid-high single digit millions, right? So how do you get to a point where you continue to drive monetization from already very satisfied customers, right? Are you a victim of your own success in your ability to take that $2 million of ARR and continue to march it higher?

Nikesh Arora

So, let's step back. What is, say a stratospheric question, roughly six to 10% of a company's technology budget is cybersecurity, right? If you look at JP Morgan, I read somewhere they spend $18 billion or something in technology or maybe off by a few billion dollars, 10% is $2 billion, right? We have 4% to 5% share of the market. So, $2 million is a good number, but our largest customer does $25 million in ARR per year. Okay? So that's the art of the possible, it's a fortune 50er company, right? That's the art of the possible, two is better than 500,000. 5,000 is better than 200,000. So, 6 years ago, when we started, we did $2 billion of revenue. Our largest deal was $5 million ARR per year. Now it's $25 million, right?

So, is there a path I can see for a few thousand customers keep marching from two up? Yes, there is. But that requires consolidation that requires them to focus on taking a platform. You asked me earlier, what is the big change that has happened is a lot of these platformization deals or these re-architectural deals in cybersecurity are driven by system integrators, people like Accenture, like Wipro, like IBM, like PriceWaterhouse, et cetera. So also, what has also changed for us in the last few years is they want to deal with less vendors. You don't -- they're hard enough understanding what they do for a living and then to understand 50 security vendors and say, I need to understand all your portfolio so I can design that architecture.

Now given our scale, which is still small, given our scale and our breadth of our portfolio, they'd rather talk to us so we can give them three platforms and go to three of us and talk about one platform each or perhaps even five of us to stitch a platform together. So, from that perspective also, I think it's.

Fatima Boolani

I want to sort of moon walk into the next area of conversation that ties to platformization, but it's around your next-generation security franchise. This was essentially a nonexistent business when you got here 6 years ago. You're now walking in at a $4 billion franchise. So, the first question, how do you see all of your efforts around platformization contributing to what are implicitly pretty high growth rates in a business of that size as you pave the path towards $15 billion of NGS ARR over the course of the next 6 years.

Nikesh Arora

Now, look 6 years ago, when we started this journey, we are a hardware company that's sort of firewall when we had a bunch of software capabilities that we had, which -- and my board says to me, et why don't you figure out how we have turned this company into a SaaS business and make it an ARR company.

Sounds great. How do I do that? I think part of what we did in the last 6 years is we spent $4.5 billion bought a bunch of companies, stitch them together into a platform. There are a lot of innovation at home and got to a point where majority of the $4 billion is net new business that we generated. So, we took our go-to-market engine, applied that to these capabilities or north of $4 billion. At the same time, we also transformed our existing business towards this. We think in the next 5 years, we can get 80% to 90% of our business in a SaaS mode where it's all recurring revenue to get to $15 million. We see a part of it. What was your question?

Fatima Boolani

Just that path towards naturally, you're going to have more and more customers with more and more pillars -- but even if you can tie it back to that aspirational, if every single one of your customers is paying $25 million in ARR, that's an excellent out.

Nikesh Arora

It's a lot better than $2 million Yes.

Fatima Boolani

There you go.

Nikesh Arora

We don't -- our expectations are not there. Our expectations are really to be able to drive value for all of our customers. So, the way we mapped it out is that were $4 billion, we have an aspiration to get to 15% by 2030. We know what each platform delivers an ARR. We did 91 last quarter. We did 65, 70 quarter before we started tracking it. If you stay in the 60% to 90% range for the next 24 quarters.

Fatima Boolani

On platformization...

Nikesh Arora

On platformization, we get to $15 billion, and in terms of opportunity, that's only 2,500 platformization across 15,000 opportunities, around 5000 customers. That's the math, right? And the thing which we said last quarter, which was interesting for us is as we traverse the last 12 months, our average ARR per platformization went up, which one would expect a scale -- if you do more, your average goes down. Actually, it was interesting, actually, it went up. It may be purely because of the size of deals, and it may go back and be where it is. But it did go down, which because we hope that our target of 3,500 will get us to $15 billion in ARR. Now it's a matter of keeping your head down and executing.

The good news is, as I said, when we started this journey 12 months ago, it was as important to tell the market that is the way we're going as it was to tell our own people. Now everyone of our sales people wants to do platform deals. Every one of our partners wants to come to us and say, let's go help you do a platformization.

Fatima Boolani

Biggest surprises, and maybe some of the key challenges that you've encountered in, like I said, scaling what was essentially a nonexistent franchise 6 years ago right? I mean certainly the past -- it seems linear, but in retrospect, there was probably a lot of twists and turns. So, anything you look back on in terms of getting from zero to four getting from four to 15, how you're going to circumnavigate some of those things that you learned from the first wave.

Nikesh Arora

Yes. Look, some things that we've been spending a lot of time on recently and we still have to continue spending time on when you're a hardware business, you sell a firewall, the customer deploys it. If they don't use it, they have it for 6 years. They paid for it is theirs. In the SaaS business, if you do sell it, they don't deploy it, when it comes time for renewal, you don't get a renewal because customers are not using it. So, there's been a huge focus in factor fear we've staffed all of our sales engineers to also have a consumption target to make sure that everything you sold is actually getting consumed.

And the good news is we see consumption. Consumption is at a good place across our products because in a year, 18 months from now, a lot of consumption is going to turn into renewals. Now the good news is different platforms and different consumption metrics and network security, less consumption metrics because you buy hardware firewalls, software firewalls and SASE. We see reasonably high consumption there. We have lots of opportunity to upsell our customers in cloud. We only sold by credit so we see consumption. And XSIAM, we actually see consumption rising, it's actually beating what we sold. XSIAM early franchisee last 18 months in. We sold, as I said, 130 of them. We've deployed 50. Our top 10, 20 customers, $1 million in ARR, but the only seen 3 or 4 customers come back and say, I'd like to buy more because we charge them for data ingestion.

So, it's good. So that's kind of the big shift is we have to become a SaaS consumption business. I think what gets lost in this is that in the last 6 years, you converted more than 50% of our business into ARR, right? It's close to 50% more. And you've done it quietly under the radar, we've formed the hardware business into a software business and think that journey continues till 2030.

Fatima Boolani

No, NGS ARR, as I think most people are familiar, it's a multidimensional franchise, right? So, you've got SASE, you've got Cortex, you've got cloud. At the highest level, when you think about the arc of the next 6 years, amongst those pillars, where are you the most bullish in terms of market share capture, monetization potential?

Nikesh Arora

I think for us...

Fatima Boolani

I know you love all the pillars equally. I just want to say that.

Nikesh Arora

You know that when you have more than one child more than one. So, they're all good. But I am excited about XSIAM because I've discovered in cybersecurity. He can replace existing TAM much faster than you can create one. you go back historically look, there should be Symantec McAfee, it got in place by the EDR way a lot of new XDR, EDR companies came by. Customers had a budget. They had a product, goes a spar superior, you see I'm going to replace it. is much hard cut, you need cloud security? What does that do? Like we use AI security? What does that do? Let me take a look at it? How does it work? I don't have the budget.

So, it's a lot harder building a new market than it is to take a market and replace it. Historically, you be replaced the endpoint security market with EDR, XDR, we've replaced the old firewall market with next-generation firewall -- and I think you're seeing that in stock. That's why we did the IBM do. We just announced disclosed it this morning. It's great. It's a $20 billion TAM. And I think we have the most advanced technology from a pure-play cybersecurity vendor out of the market, I think we're about 18 months to 24 months ahead of anybody else out there. I always believe that if there's economic profit to be made, everybody is going to change you down. This is not forever.

So, that's why we're putting on turbocharge, what it also does for the first time in security, it's an outcome-based technology. I go to people and say, I can take your time to fix your security issues from four days to -- we are at one minute our first customers are at nine minutes. They can solve the security issue in 9 minutes. Industry averages 4 days to 7 days. When I go make that pitch and I can convince customers or way ahead of everybody else. But when they get an outcome-based thing going, I can slowly work my way into getting to absorb more and more capability in the platform as well as they keep building capability the platform.

So, I think 5 years from now, hopefully, if you're sitting here talking about this, you'll say, my God, you've got 2,000 XSIAM customers, and they've got everything in your platform because you work your way from there all the way back because the other things become less relevant because they're more interested in the outcome. So, I'm really excited about that. There's a lot of focus across our company in terms of trying to make that real and execute on it. If you said to me 18 months ago, will you get close to 700 in TCV in 18 months, that's never been done the sub-security before.

Fatima Boolani

So, you talked about this. So, we will stick to core tax just because that seems to have so much more promise. You alluded to the fact that there has been major market shake ups here. I mean you actually were part of shaking up the market with the AV IBM QRadar. So, I wanted to talk about the whole QRadar transaction is it seems like a pretty big strategic cue for you. The calculus there, I think it's apparent why you did it, but I'd love to kind of hear it in your perspective. Why them? Because there are other assets in the space.

And then just relatedly, from a incremental product and go-to-market strategy perspective, how are you positioning yourself to be in the pole position for when SOC architectures and entire SOCS are modernized because I think we are on the cusp of a major technological upgrade of most SOC over the course of the next 5 years, 7 years.

Nikesh Arora

Yes. No, no, I think that's what I said. It's a $20 billion market, which will get replaced. You will see it end up like the endpoint market was where the existing players are going to have to give up share to newer players in the market. Now the not understanding cybersecurity as well. I'm a huge student of M&A. And a lot of M&A transactions fail because you got extremely complicated to execute and implement. When you end up having to maintain existing customer base, existing code, your new code, new customer base, and it's very problematic. And there are companies out there which have four solutions in the same space because they got 4 different companies, they were never able to integrate.

So, our deal with IBM is unique where when Arvind and I first talked about it about 2 years ago, and we sure what we're working on, he wasn't was sure. But as we got to a point where you saw the benefits of XSIAM. I see it. I see this is what's going to disrupt what we have. And we got ahead of it and key folks he's focusing more on DevOps and the AI stuff, and we said, look, let us be your cybersecurity partner. Now the deal is unique because we didn't buy any assets, except for IP and their customer base. So, we have our own product, our own code, we don't test the core. In fact, as of this morning, all the that rock customers who secured our SaaS version of our customers, but I've been running it for us. We actually have given an outsourcing contract to run that business for us, which means for the customer, nothing changed. They still on the same people at IBM, but IBM running it for us.

Any time the customer wants to renew the deal, they have to come to us. And we say, don't renew QRadar because it's ours, we're going to move you to XSIAM. So literally, we're going customer by customer and transitioning them to Palo Alto, but we're not touching any code or any of their people. in the process, which is a very unique arrangement because it helps us avoid a lot of the pitfalls you will run into in an M&A transaction, right? So, every new customer is onboard onto my systems, I have no IT integration. There's no finance issues, no sales force issues. It's just -- I'm running my business. I'm exploring them into my business, and they have an incentive to migrate every customer to me, both QRadar our SaaS as well as the on-prem customers. So that's kind of like interesting for us.

Fatima Boolani

We were talking about the soft line, but I think it's a really helpful line of conversation. Just as it relates to incentives and incentive structures around IBM and Palo Alto. So, Palo Alto badged account executives versus IBM badged services and systems integrators. How is that economic and incentive relationship working? I mean what's the alignment looking like? You said the alignment is there, but can you put some...

Nikesh Arora

Look, our people continue to get paid for what they get book to Palo Alto. And every time the next time we need to be had, our sales rep will go, they'll get paid on booking that deal with us. IBM has tremendous amounts of incentive to migrate those customers to us, both economically because we're paying them. And also, for them, they want their customers off of QRadar because that's not something they're investing in. So, they want their customers to get seamlessly migrated by Alto.

So, they're paying their salespeople. And jointly, we're funding the migration for the customer. So, in listen, your migration from QRadar to XIM was funded by Palo Alto and IBM together. And so, the customer gets a free migration, the sales rep from IBM gets paid, and they can decide at any point in time to bring in their friend from Palo Alto, who's also going to get paid, so they have to work together. I've never seen such good alignment with the partner in a while.

Fatima Boolani

Now I'd be remiss if I didn't ask you about the NetSec SASE business.

Nikesh Arora

Sure.

Fatima Boolani

You had this be your dominant bread-and-butter franchise, but it's had a renaissance over the course of the last 4 years, right? So, as you think about the scope of the SASE footprint and the market opportunity against what has been very much evolving market demand. What does the next 5 years of opportunity look like within the SASE franchise. And how are you focusing and prioritizing innovation in the SASE franchise just from a product development standpoint.

And look, I think the genesis of the question is there's going to be hardware exposure in your business for a long time to come. And I think there is maybe a perception or a misperception that other parts of the business with much sexier growth trajectories are going to get a lot more love from an R&D allocation standpoint. So, what is the product strategy vision around SASE and how you continue to be dominant in the SASE arena, which has historically been where you've been very dominant.

Nikesh Arora

Yes. Look, we've been -- the customer's choice as we're not dominant. Customers have chosen our firewalls in the hardware space. And by the way, Hunter is not bad. I heard Michael Dell is here. We've got a good hardware business and video has a hardware business. These are not bad businesses, FYI. So, hardware is a good business is going to be around for a while because hardware is still the lowest cost per throughput, you want to pump a lot of bits and bytes. The fast the cheapest thing is to put hardware in place.

Software is more expensive to run because it requires -- eventually has to run on somebody's hardware. So, it's still the lower throughput. So, I think the hardware business is going to be around. It's just that the proportion of our software business continues to increase. It's just not. Now the big shift that's happening is as people move to the cloud, they're moving all their applications in the data centers to the cloud, the way we access the LLM-based [ph] applications is changing as employees or users. And that access mechanism is what we call SASE. Five years ago, there was one major player in the space because they got there early. Today, there's seven of us trying to change that market down. We're the second largest SASE player in the market. I think by now, we were not a player 4 years ago.

And that's because we come from the roots of our hardware business where we were able to pivot and bring all the capabilities on the software side. But the big difference in SASE that happens is in hardware, we sold the hardware of the customer in SASE, we run the service. So, when you log in from a laptop, you're running in Palo Alto's bits and bytes to access your trading app or your portfolio optimization app in the back. That's a big change in the industry, and it takes time to sink in, right? So, we have north of 15 million to 20 million users who are actually running on our pipes. So, a large component of companies like IBM just bought that product. So, we're going to power IBM 250,000 employees accessing all their applications using our SASE product.

Now, if that's the way your employees access your applications, the question becomes in innovation, what's going to change in that mechanism? What are they going to be doing? What's going to be different? One, architecturally, we're different because we decided not to build our own data centers. They're two ways to it. You can build your own data center 150 countries. We're not a data center company. I cannot run 150 data centers a 99.9% availability. That's a different set of business that do that.

Fatima Boolani

Right.

Nikesh Arora

So, we decided to ride on Google Cloud and AWS and Oracle pipes. So, they run that 99.9% availability business. We run on them, and we switch between them depending on which customer wants what whether we're seeing availability while is the other. It's one big difference structurally.

A second big difference is, we think, as technology evolves, a lot of our employees and your employees are going to be using AI. So, it becomes even more important to see how do you govern that usage. And now that we're in the 15 million to 20 million laptops, that's growing as the SASE business, lots and lots of innovation is going to depend on how do you look at what people do, how do you do data loss prevention and if I'm using an app and I'm uploading my company on jewels in there, I need to be able to block that. How do you block that if you're not in the part of how an employee accesses that application? So that's a lot of where the innovation is going to be.

We made a bet about a year ago. on the enterprise browser. We said that having VPN agents and laptops is not the right way in the long term because we need to be able to see what you're typing so we can -- now your employers need to see to make sure you're not shipping the wrong data there. So, I think enterprise browser is going to be a renaissance in the SASE space. We're the only player with an integrated enterprise browser now, Affrachannel acquisition. There's not many options in the market. We think AI governance is going to become important in SASE, because both products we've launched already in the last few months so.

Fatima Boolani

$200 million in ARR.

Nikesh Arora

Sorry what?

Fatima Boolani

ARR products are about $200 million in ARR?

Nikesh Arora

Yes, that’s good XSIAM plus AI Access in there.

Fatima Boolani

Okay. Just to round out the...

Nikesh Arora

I think that the significance of that is historically, back to the strategy point. Historically, our customers will always in the midst of replacing some security technology that have become obsolete. If you look at every CISO, they've got some projects on ripping this out because it's -- that company is no longer there or they haven't kept at innovation.

Our aspiration in addition to platformization is you want to make sure that you never have to report our product. We don't want to be that endpoint product that we place with XDR. We don't want to be that SOC that you took place in the future. So, part of the paranoia you see in us is that we're also looking at where technology is evolving. So instead of us getting replaced by a start-up from Israel perhaps giving you an AI firewall, we launched a fully functional Firewall 2 weeks ago. right? So, you don't have to replace ballot. You can take our virtual firewalls, which are embedded in Google Cloud, AWS, Azure, Oracle, IBM and deploying the firewall there.

So, part of the paranoid we have is that we need to stay ahead of this product development curve, not just in SaaS, but in every category, we play in. So that way, we're the ones that are replacing other people who are not the ones getting replaced.

Fatima Boolani

I wouldn't be a card-carrying software analyst if I didn't ask you about generative AI. So, I appreciate you saying that. It sounds like a lot of infusion of those capabilities across the portfolio. but more specifically around the governance of AI is kind of the opportunity you're tackling. So, I appreciate you kind of frame that.

Just around out the NGS ARR conversation, Prisma Cloud, it's been an arm's race here. How are you ensuring that there's franchise growth durability here outside of your fortunes being covered to general hyperscaler adoption trends historically. I know there's been a lag impact, right? But how are you kind of thinking about the durability of that franchise? And just from a market structure perspective, very different than it was 2 years ago, 5 years ago, pricing dynamics have also changed. I think maybe you'd argue there's a little bit of an oligopolistic behavior in the market structure, but you can tell.

Nikesh Arora

It's like we're in kindergarten, kindergarten, kids don't understand oligopolis so.

Fatima Boolani

I love it. Okay. Okay. What's the calling card here for you to take disproportionate share with Prisma Cloud?

Nikesh Arora

Look, cloud security has gone through its own evolution. As I said, it's hard to make a market and tell customers is the right way it's going to evolve, and you have to watch it carefully. I'd say 3 years, 4 years ago, we were here we'll be talking about hygiene and cloud security. It's all about misconfiguration. oh, my god, I set up my AWS wrong. You can have a breach or I wrote the code wrong, you can have a breach. As people have moved to applications to the public cloud, what happened is you have live applications running in public cloud. It's a long about what mistake could I have made that's going to cause we say, oh, my God, there's somebody going after my stuff.

So, what's happening in cloud is the focus is shifting from, I'll call it, CNAPP for which is basically a five-letter word for all the configuration mistakes you can make in setting up your public cloud to run time security. It's like don't worry about how I configure it, what about if somebody is actually attaching me, right? Because when I tell you, you misconfigured this, you could be second getting a sort of a nutrition lecture from your partner. You didn't eat right, you didn't do this should -- yes. I know if I fix all of that stuff on be amazing.

Fatima Boolani

Fix that.

Nikesh Arora

Yes, exactly. But think about what's wrong going to be right now, let's go to emergency. So, things are going to shift from -- that's a good analogy to some of the morning, but we go from CNAPP to runtime security.

Fatima Boolani

Right.

Nikesh Arora

That's what's shifting in cloud. So, you're seeing the focus back where CDR agents like we have with XDR, some of the companies to do real-time cloud security becoming more and more relevant, and pricing is collapsing on the CNAPP side because it's so the table stage, it and we've seen that in the market. even now, we have a $700 million ARR franchise, which still makes us the largest independent cloud security player as an independent company, you guys will be chasing it with even a better valuation than perhaps I heard in the market for somebody else in the space, which is CNAPP only.

So, I think it's still an evolving market. We have seen many companies come and go in this space in the last 5 years because they haven't been able to get traction. And again, it's nontrivial to build a 14-module platform that does a lot of these things and connect the dots. So, this is not going away anytime soon. I just think you guys get a little impatient sometimes in these spaces.

Fatima Boolani

The growth objective crystal clear, but I think the unenviable task is you've got, again, very wide portfolio around innovation, and innovation priorities. How are you thinking about R&D prioritization, right? But also related to that, kind of running and driving more and more efficiency as a business, right? You're a big company now. You've grown up, right? So, there's some of these priorities around here some of us want to see margin expansion and free cash flow growth and all those fancy things, right? So how are you thinking about the overall aggregate investment envelope in operating expense prioritization.

Nikesh Arora

Look, I don't think we're too big. We're an $8 billion revenue business last year. I think in the sweet spot, honestly, of size of companies, 15,000 employees, if you're too small, or $1 billion in revenue and you have 3,000 employees, you actually can't do any efficiency. You can't go invest $10 million to see can I get coding faster and say, myself, 1,000 engineers. Or you can't deploy it against customer support and say, can I reduce my customer support headcount by 30%, can I invest $20 million because you are $1 billion revenue business at $88 billion we can. So, there are a lot of initiatives right now to see how does AI help us from a productivity perspective. And we've discovered, it requires us to rethink our processes and do a bunch of sell.

A very simple example, we have -- like we had internal employee tickets of 250,000 employed tickets being 15,000 employees. We deployed generative AI. We had a bunch of work going on with automation. We've been able to take 75% of those heads out. We took out 150 people in internal ticketing, which is an internal project. We did that. We deployed Generative AI. So, there are ways to go drive efficiency at this size. I think it's hard to do it to get 30,000 employees because it's more complex. And it's uneconomical do it if you have 2,000 employees because you should be going out and chasing growth.

So, we like the size we're at. we think we can balance the investment needs and keep our operating margins consistent with where they are, which I think for our scale in our industry, they're in a better spot than most other people. I think there's room for them to go better.

Fatima Boolani

Last two questions for you to wrap what's been a fantastic discussion. M&A, you've got your fingers very much on the pulse on the market. You've been very active in the space. Operations on dislocations or lack thereof in the private markets? Where are we in the cycle of rationalization and innovation and intrigue.

And then my final question for you is the last 6 years were so much fun for you at Palo Alto, you signed up for another 5 years to run the company. So, I wanted to ask you for your policy agenda -- in the way we end our conversation for the next year.

Nikesh Arora

So, quickly on the M&A front, I think look, we had technical debt to pay. We were perhaps the most active cybersecurity M&A buyer in the market.

Fatima Boolani

Right.

Nikesh Arora

About 19-odd companies in the last 5.5 years, 6 years. But as now we're in front of the big swim lanes of cybersecurity, we always have to make a decision. Can we build this ourselves or is the innovation is so great that we have to go acquire? So, we did the enterprise browser. The integration was not complex, -- we got it done in 6 months, but some things have become overlapping, become complex, which is something I don't like.

We'd have to shut down a bunch of stuff, which is too complicated to do from an engineering perspective, that's how you end up with technical debt. So, I think the M&A environment is cooling off, to be honest. I think there's still a dislocation in price versus value and the expectations of startups. And I think that will fix itself if there are no buyers eventually you set your expectations right. There are companies that were hot 5 years ago. They're still around. They haven't crossed $20 million in ARR, $30 million in ARR, now we're going to pay for them. So, I think the private market is cooling off and will continue to cool up I think the consolidation market will be the next market in play.

You will find that company in the $1 billion to $5 billion, $7 billion, $10 billion range are going to be looked at by a lot of players to see, can I get heft to catch up with Palo Alto or not. And that's going to be an interesting play. And that's where I think a lot of mistakes will be made, but it will be interesting to see. And the policy, what was the policy?

Fatima Boolani

Next 5 years what would be policy agenda.

Nikesh Arora

I think the most dangerous thing is to believe that you can rest on your laurels for the last 5 years and say, "I've got this figured out because that's when all the bad things happen. So as keep staying paranoid keep seeing where the market is coming at you. It doesn't mean that there won't be a great company that will be born somewhere that we have to take a look at hard to see do we innovate or do we buy. We got to keep that going. We've got to keep our heads down and execute. There is a lot of -- enterprise a lot about perspiration. You still going to get those 3,500 platformization done.

But a lot of the plumbing picking, getting our ship ready has been done in the last 5 years. So hopefully, we have a smoother ride on the execution side. But as you said to me earlier, the bar is higher. So, you got to execute more flawlessly, more times than we have had to in the past. So, there is a constant growing up. That's why I said kindergarten versus them reaching [indiscernible] but lots of good stuff to ahead.

Fatima Boolani

Fantastic. Thank you so much for such a candid discussion

Nikesh Arora

Thank you.